from __future__ import annotations

import json

import pytest

from src.services.gitea_workflow_runner_health import load_latest_gitea_workflow_runner_health


def test_load_latest_gitea_workflow_runner_health_reads_newest_file(tmp_path):
    older = _snapshot(generated_at="2026-06-04T00:00:00+08:00", completion=40)
    newer = _snapshot(generated_at="2026-06-05T00:00:00+08:00", completion=100)
    (tmp_path / "gitea_workflow_runner_health_2026-06-04.json").write_text(
        json.dumps(older),
        encoding="utf-8",
    )
    (tmp_path / "gitea_workflow_runner_health_2026-06-05.json").write_text(
        json.dumps(newer),
        encoding="utf-8",
    )

    loaded = load_latest_gitea_workflow_runner_health(tmp_path)

    assert loaded["generated_at"] == "2026-06-05T00:00:00+08:00"
    assert loaded["program_status"]["overall_completion_percent"] == 100
    assert loaded["rollups"]["total_workflows"] == 2
    assert loaded["operation_boundaries"]["workflow_modification_allowed"] is False


def test_gitea_workflow_runner_health_requires_read_only_mode(tmp_path):
    snapshot = _snapshot()
    snapshot["program_status"]["read_only_mode"] = False
    (tmp_path / "gitea_workflow_runner_health_2026-06-05.json").write_text(
        json.dumps(snapshot),
        encoding="utf-8",
    )

    with pytest.raises(ValueError, match="read_only_mode"):
        load_latest_gitea_workflow_runner_health(tmp_path)


def test_gitea_workflow_runner_health_requires_blocked_operations(tmp_path):
    snapshot = _snapshot()
    snapshot["operation_boundaries"]["runner_restart_allowed"] = True
    (tmp_path / "gitea_workflow_runner_health_2026-06-05.json").write_text(
        json.dumps(snapshot),
        encoding="utf-8",
    )

    with pytest.raises(ValueError, match="operation boundaries"):
        load_latest_gitea_workflow_runner_health(tmp_path)


def test_gitea_workflow_runner_health_requires_rollup_consistency(tmp_path):
    snapshot = _snapshot()
    snapshot["rollups"]["workflows_with_schedule"] = 99
    (tmp_path / "gitea_workflow_runner_health_2026-06-05.json").write_text(
        json.dumps(snapshot),
        encoding="utf-8",
    )

    with pytest.raises(ValueError, match="workflows_with_schedule"):
        load_latest_gitea_workflow_runner_health(tmp_path)


def test_gitea_workflow_runner_health_requires_quiet_notification_contracts(tmp_path):
    snapshot = _snapshot()
    snapshot["notification_contracts"][0]["success_noise_policy"] = "always send success"
    (tmp_path / "gitea_workflow_runner_health_2026-06-05.json").write_text(
        json.dumps(snapshot),
        encoding="utf-8",
    )

    with pytest.raises(ValueError, match="suppress success noise"):
        load_latest_gitea_workflow_runner_health(tmp_path)


def test_gitea_workflow_runner_health_rejects_secret_payload_keys(tmp_path):
    snapshot = _snapshot()
    snapshot["latest_observations"][0]["runner_token"] = "redacted"
    (tmp_path / "gitea_workflow_runner_health_2026-06-05.json").write_text(
        json.dumps(snapshot),
        encoding="utf-8",
    )

    with pytest.raises(ValueError, match="forbidden secret payload key"):
        load_latest_gitea_workflow_runner_health(tmp_path)


def test_gitea_workflow_runner_health_fails_when_missing(tmp_path):
    with pytest.raises(FileNotFoundError):
        load_latest_gitea_workflow_runner_health(tmp_path)


def _snapshot(
    *,
    generated_at: str = "2026-06-05T00:00:00+08:00",
    completion: int = 100,
) -> dict:
    return {
        "schema_version": "gitea_workflow_runner_health_v1",
        "generated_at": generated_at,
        "program_status": {
            "overall_completion_percent": completion,
            "current_priority": "P1",
            "current_task_id": "P1-002",
            "next_task_id": "P1-003",
            "read_only_mode": True,
        },
        "source_refs": ["docs/schemas/gitea_workflow_runner_health_v1.schema.json"],
        "rollups": {
            "total_workflows": 2,
            "by_workflow_status": {"manifest_mapped": 2},
            "by_runner_evidence_status": {"host_runner_mapped": 1, "owner_attestation_required": 1},
            "workflows_with_schedule": 1,
            "workflows_with_workflow_dispatch": 1,
            "workflows_with_notify_bridge": 1,
            "workflows_with_actionable_or_failure_quiet_policy": 1,
            "workflow_ids_requiring_runner_attestation": ["e2e_health"],
            "total_runner_contracts": 1,
            "runner_contracts_requiring_action": ["ubuntu_latest"],
            "notification_contracts_total": 2,
            "notification_contracts_quiet_success_count": 2,
            "notification_contracts_quiet_success_ids": ["actionable_only", "failure_only"],
        },
        "workflow_records": [
            _workflow_record(
                "cd_pipeline",
                "host_runner_mapped",
                ["push"],
                "deployment_status_exception",
                1,
            ),
            _workflow_record(
                "e2e_health",
                "owner_attestation_required",
                ["workflow_dispatch", "schedule"],
                "failure_only",
                0,
            ),
        ],
        "runner_contracts": [
            {
                "contract_id": "ubuntu_latest",
                "display_name": "ubuntu-latest runner label",
                "status": "action_required",
                "risk_level": "high",
                "runner_labels": ["ubuntu-latest"],
                "used_by_workflows": ["e2e_health"],
                "health_contract": "只讀確認 runner label 與 recent run freshness。",
                "guardrail_refs": ["docs/HARD_RULES.md"],
                "evidence_refs": [".gitea/workflows/e2e-health.yaml"],
                "next_action": "補 owner attestation，不改 runner。",
            }
        ],
        "notification_contracts": [
            _notification_contract("actionable_only", "actionable_only", "無 actionable 時不通知。"),
            _notification_contract("failure_only", "failure_only", "健康成功不通知。"),
        ],
        "latest_observations": [
            {
                "observation_id": "committed_only",
                "status": "verified",
                "summary": "只讀 committed workflow。",
                "evidence_refs": ["docs/LOGBOOK.md"],
            }
        ],
        "operator_contract": {
            "display_mode": "read_only_gitea_workflow_runner_health",
            "must_not_interpret_as": [
                "workflow 修改批准",
                "runner restart / stop 批准",
                "Secret 已讀取或可輸出",
                "Telegram 測試通知批准",
                "Gitea write token 授權",
                "deploy / migration workflow 觸發批准",
            ],
            "secret_display_policy": "只顯示 redacted metadata。",
            "runner_mutation_policy": "不得 restart runner。",
            "notification_policy": "成功不洗版。",
        },
        "operation_boundaries": {
            "read_only_api_allowed": True,
            "workflow_modification_allowed": False,
            "runner_restart_allowed": False,
            "runner_container_stop_allowed": False,
            "runner_label_change_allowed": False,
            "runner_registration_allowed": False,
            "secret_read_allowed": False,
            "secret_plaintext_allowed": False,
            "notification_send_allowed": False,
            "schedule_enable_allowed": False,
            "gitea_api_write_allowed": False,
            "deploy_trigger_allowed": False,
            "migration_trigger_allowed": False,
        },
        "approval_boundaries": {
            "workflow_modification_authorized": False,
            "runner_mutation_authorized": False,
            "notification_send_authorized": False,
            "secret_plaintext_allowed": False,
            "runtime_execution_authorized": False,
            "schedule_change_authorized": False,
            "gitea_write_authorized": False,
            "deploy_trigger_authorized": False,
            "migration_trigger_authorized": False,
        },
    }


def _workflow_record(
    workflow_id: str,
    runner_evidence_status: str,
    triggers: list[str],
    notification_policy: str,
    notify_bridge_calls: int,
) -> dict:
    return {
        "workflow_id": workflow_id,
        "file_ref": f".gitea/workflows/{workflow_id}.yaml",
        "display_name": workflow_id,
        "scope": "只讀 workflow 合約。",
        "status": "manifest_mapped",
        "risk_level": "medium",
        "triggers": triggers,
        "schedule_cadence": "每日" if "schedule" in triggers else "無定期排程",
        "runner_labels": ["awoooi-host" if runner_evidence_status == "host_runner_mapped" else "ubuntu-latest"],
        "runner_evidence_status": runner_evidence_status,
        "job_count": 1,
        "notification_policy": notification_policy,
        "notify_bridge_calls": notify_bridge_calls,
        "secrets_policy_status": "不讀 Secret payload。",
        "evidence_refs": [f".gitea/workflows/{workflow_id}.yaml"],
        "next_action": "只讀補證據。",
    }


def _notification_contract(contract_id: str, policy_kind: str, success_noise_policy: str) -> dict:
    return {
        "contract_id": contract_id,
        "display_name": contract_id,
        "status": "preserved",
        "policy_kind": policy_kind,
        "success_noise_policy": success_noise_policy,
        "failure_policy": "失敗才升級。",
        "workflow_refs": ["e2e_health"],
        "evidence_refs": [".gitea/workflows/e2e-health.yaml"],
        "next_action": "保留通知政策。",
    }
